Recent years have seen a growing realisation regarding the great economic and manipulative power of data and information. They have also been marked by a series of human tragedies¹ involving encrypted data, high-profile computer compromises, audacious cybercriminal ransomware hits, the monetisation of hate speech, and increased geopolitical dynamics; each exposing uncomfortable cross-border dependencies. These have led to greater legislative enforcement against abuses and regulatory scrutiny of cyberspace/digital activities, requiring firms to adapt to a fluid and ever-changing landscape.

As a result, the trending global regulatory focus on cyberspace and its participants addresses a diversity of areas encompassing cybersecurity, transparency of online content governance, personal data privacy, non-personal data confidentiality, data localisation and mirroring, outsourcing and the use of cloud service providers, encryption backdoors, decryption, competent authorities’ access to data (whether at a national level or overseas), and measures to rebalance the digital ‘winner-takes-all’ business models. Recent examples* of regulatory attention include:

The Budapest Convention, which came into force in 2004, is an international treaty that focuses on cybercrime, which 65 countries have ratified. The Convention seeks to harmonise laws related to cybercrime and support international cooperation in the fight against cybercrime, while it also serves as a limited mutual legal assistance treaty. An update² to the Convention is ongoing to reflect new criminal justice challenges and to support more effective cross-border cooperation on issues such as electronic evidence. The final protocol is expected later in 2021.

The European Commission published a new EU Cybersecurity Strategy in December 2020

In late July 2020, China’s Securities Regulatory Commission issued a consultation paper on new rules for the reporting, investigation and management of cybersecurity incidents in the securities and futures industry.³ It aims to improve incident classification methods and accountability and incident handling, among other areas. The consultation period closed on 11 January 2021.

The European Commission published a new EU Cybersecurity Strategy⁴ in December 2020, which covers three action areas:

• Resilience, technological sovereignty and leadership;
• Building operational capabilities to respond to and deter cyber threats; and
• Increasing cooperation for a more global and open cyberspace.

A further two legislative proposals were also issued – a new draft Directive on the resilience of critical entities, and a revised Directive on measures for a high common level of cybersecurity across the Union.

A new decryption platform was launched in December 2020 by the European Union Agency for Law Enforcement Cooperation (Europol), developed with the European Commission’s Joint Research Centre, that increases Europol’s capabilities to decrypt information lawfully obtained in criminal investigations.⁵

Its decryption goal has much in common with Australia’s Telecommunications and Other Legislation Amendment Act of 2018, under which law enforcement and intelligence agencies can request technology companies to provide technical assistance including decryption.

A similar policy direction was also reflected in the latest (October 2020) call by the UK, US, Canada, Australia and New Zealand – the so-called ‘Five Eyes’ countries – together with India and Japan, for the introduction of encryption backdoors for law enforcement.

The Digital Services Act (DSA) was published in draft form by the EU in December 2020.⁶ The DSA defines four categories of online services, with each having increased regulatory obligations. They include transparency reporting, details of automatic means used for content moderation, disputes, advertising transparency such as identifying the sponsors of advertisements, and transparency of the main parameters used in recommendation systems.

Transparency reporting as proposed in the DSA is similar to transparency reports that US-based technology companies began issuing around 2014, when they won the right to publish reports on the volume and type of national security requests they receive.

In the US, the SAFE TECH Act announced in February 2021⁷ outlines amendments to Section 230 of the Communications Act of 1934.⁸ Its central proposition is that social media platforms should have accountability for certain types of content; for example, if promoting paid advertising that was harmful.

The EU published the draft of the Digital Markets Act in December 2020.⁹ This proposed regulation will focus on the largest digital platforms to calibrate competitive and bargaining powers. Those entities coming within its auspices will be subject to requirements that include no combining of personal data from different (related) platforms without consent; no restrictions on users who want to switch to third-party apps and services despite using the platform’s operating system; and data portability.

China published the final version of the Anti-Monopoly Guidelines for the Platform Economy¹⁰ in February 2021.¹¹  These guidelines support regulators in applying restraints on internet platforms engaging in monopolistic practices. They define in-scope platforms and identify four types of antitrust activity, including abuse of a dominant market position and using administrative power to restrict competition.

India’s authorities have consulted on the proposed Non-Personal Data Framework since publication of the draft in July 2020.¹² This comprehensive framework covers anonymised personal data and aggregated data created and collected in India. It would govern “inextricably linked” personal and non-personal data, an expanded definition of what constitutes data business, the concept of “high-value datasets”, and proposed public, community and private non-personal data classification to guide the level of compliance. Data transfer across borders could potentially be impacted. The Framework also introduces new roles and responsibilities, including those for data custodians and data trustees.

In 2020, China proposed a global initiative on data security, regarded as a counterproposal to the US’s Clean Network coalition-based initiative to address ongoing threats to data privacy, security and confidential information from aggressive intrusion. The Chinese proposal called on states to “foster an open, fair and non-discriminatory business environment”, and suggested that countries should “stand against ICT activities that impair or steal important data of other states’ critical infrastructure”. How both initiatives by the world’s two largest economies subsequently develop will be important for industries and businesses.

In the landmark Schrems II judgment, the Court of Justice of the European Union invalidated the EU-US Privacy Shield framework, and ruled in favour of stricter requirements for the transfer of personal data that uses standard contractual clauses.¹³ As a result, companies in the EU cannot legally transfer data to US-based companies through the Privacy Shield framework. An EU Parliamentary publication¹⁴ had previously highlighted concerns regarding “cryptanalytic and quantum computing” impacts on encryption effectiveness.

In January 2021, ASEAN launched the ASEAN Model Contractual Clauses (MCC) for Cross Border Data Flows.¹⁵ Recognising the different development stages of ASEAN member states, the MCC is a voluntary scheme that provides a standard for ASEAN private sector companies to follow when it comes to the transfer of personal data.

"What in 2010 The Economist first dubbed the “Balkanisation of the internet” through regulations – also called “cyber-Balkanisation” and “splinternet” – is becoming more visible today."
Boon-Hiong Chan, Head of Securities Market and Technology Advocacy, Securities Services, Deutsch Bank Corporate Bank

Such related regulatory initiatives are far-reaching. In the foreseeable future, they include the fortification of jurisdiction boundaries through a country’s exercise of greater autonomy over its part of the global internet, and the cyberspaces of China, India, Europe, the US, and even ASEAN are becoming distinctive. What in 2010 The Economist first dubbed the “Balkanisation of the internet” through regulations – also called “cyber-Balkanisation” and “splinternet” – is becoming more visible today.

This trend will extend to the operating models of businesses, including cross-border scalability, and back-up and recovery planning. For example, uses of application programming interfaces across jurisdictions and the data that can be pulled, processed and stored can be affected. Machine learning training needs to factor in potential gaps in data sets, while cross-border uses of distributed ledger technology for financial activities and digital asset transactions can run into complex legal and regulatory matters.

Businesses’ policies, processes, systems and standards will need to be continuously updated in line with digital operational resilience regulations, and overlapping extraterritorial reaches. The heavy penalties for non-compliance will necessitate informed attention from C-suite executives.

*Regulatory updates as at 31 March 2021.

Sources

¹ See https://bit.ly/3dHvYwT at ctc.usma.edu
² See https://bit.ly/3tNNlly at rm.coe.int
³ See https://bit.ly/2PKOwnQ at csrc.gov.cn
⁴ See https://bit.ly/2OwLumO at ec.europa.eu
⁵ See https://bit.ly/3sZstIr at europol.europa.eu
⁶ See https://bit.ly/39NCGQE at ec.europa.eu
⁷ See https://bit.ly/3fQpDSj at warner.senate.gov
⁸ See endnote 7
⁹ See https://bit.ly/3dzIdve at ec.europa.eu
¹⁰ See https://bit.ly/3d0vkeY at lexology.com
¹¹ See https://reut.rs/3fSJbFM at reuters.com
¹² See https://bit.ly/3wzhJTk at lexology.com
¹³ See https://bit.ly/2OsEeIt at europarl.europa.eu
¹⁴ See endnote 13
¹⁵ See https://bit.ly/3xAntin at asean.org